## Roles and permissions

URL: https://docs.atlan.com/product/capabilities/governance/data-quality/snowflake/faq/roles-and-permissions

> Explanation of Snowflake's security model and role requirements for data quality operations.

This document answers common questions about the roles Atlan creates or requires in Snowflake, why elevated permissions such as **dq_admin** are necessary, and how Snowflake's built-in controls keep your data safe.

:::info Updated permission model
The permission model has been updated to use **SELECT access** instead of table owner role grants. This simplifies setup and reduces privilege requirements. Existing setups with table owner role grants continue to work.
:::

### What permissions does `dq_admin` need?

The `dq_admin` role requires **SELECT access** on your customer tables to enable data quality monitoring. Using Snowflake's `EXECUTE AS ROLE` feature, Atlan can attach and manage data metric functions (DMFs) on your tables without requiring the `dq_admin` role to own those tables.

The `dq_admin` role needs:
- **SELECT** on customer tables and views (to read data for quality checks)
- **SNOWFLAKE.DATA_METRIC_USER** database role (to work with DMFs)
- **EXECUTE DATA METRIC FUNCTION** on account (to run quality checks)

This simplified permission model ensures that while the role has necessary privileges to manage data quality checks, it operates with minimal access to your data—only what's needed to monitor quality.

### How does Atlan's security architecture protect your data when using `dq_admin`?

**Atlan is never granted direct access to the `dq_admin` role**. Instead, the security architecture works through controlled indirection:

**Access control through stored procedure** 
Atlan can only interact with the `dq_admin` role indirectly through a secure stored procedure called `MANAGE_DMF`. This procedure:
- Uses Snowflake's `EXECUTE AS ROLE` feature to run DMF operations with `dq_admin` privileges
- Exposes only limited, predefined data quality operations—nothing more
- Executes all operations strictly within Snowflake's secure execution context
- Ensures that privileges can't be misused or escalated

**Minimal access principle** 
The `dq_admin` role only needs:
- **SELECT** on your tables (read-only data access for quality checks)
- **Data Metric Function permissions** (to run quality monitoring)

**Security boundaries remain intact** 
This architecture ensures that:
- Atlan can't assume the `dq_admin` role directly
- The `dq_admin` role has read-only access to your data
- All operations remain strictly controlled within Snowflake
- Your existing data governance and access boundaries stay fully protected

This security-first design enables Atlan to orchestrate data quality workflows without compromising your control, visibility, or trust in your data platform

---